EUVD-2026-75020
GHSA-32f6-mgwr-pvc4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable deserialization with no authentication in worst-case deployment; exclusively availability impact via O(n²) CPU exhaustion with no confidentiality or integrity breach.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.
AnalysisAI
Deserialization in t-digest 3.1 through 3.3 allows remote attackers to inject IEEE 754 NaN values as centroid means via crafted byte streams passed to MergingDigest.fromBytes(), bypassing absent validation checks. The injected NaN values corrupt the internal total-ordering invariant of the centroid list, causing sort comparisons to return inconsistent results and degrading subsequent merge operations from O(n log n) to O(n²) algorithmic complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target application must call MergingDigest.fromBytes() on byte data that is fully or partially controlled by an untrusted party - this requires either a network endpoint accepting raw t-digest byte streams, a file-upload or message-queue path that processes t-digest-formatted payloads, or an inter-service channel where attacker-injected data reaches the deserializer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) represents worst-case exposure assuming a network-accessible, unauthenticated deserialization endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | A fix has been committed to the t-digest main branch at commit 8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c, patching both MergingDigest.java and Sort.java; however, a specific patched release version number is not confirmed from available input data, and users should check the GitHub releases page (https://github.com/tdunning/t-digest) for a tagged release beyond 3.3 or build from the fixed commit directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all applications and services using t-digest library to identify instances running versions 3.1 through 3.3 and determine whether they process untrusted or externally-sourced t-digest payloads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today